Cybercrime costs a total loss of about $338 billion annually which makes it one of the most profitable criminal activities in the world. Controlled malware (Botnet) is one of the most prominent tools used by cybercriminals to infect, compromise computer networks and steal important information. Infecting a computer is relatively easy nowadays with malware that propagates through social networking in addition to the traditional methods like SPAM messages and email attachments. In fact, more than 1/4 of all computers in the world are infected by malware which makes them viable for botnet use. This thesis proposes, implements and presents the Self-healing framework that takes inspiration from the human immune system. The designed self-healing framework utilises the key characteristics and attributes of the nature’s immune system to reverse botnet infections. It employs its main components to heal the infected nodes. If the healing process was not successful for any reason, it immediately removes the infected node from the Enterprise’s network to a quarantined network to avoid any further botnet propagation and alert the Administrators for human intervention. The designed self-healing framework was tested and validated using different experiments and the results show that it efficiently heals the infected workstations in an Enterprise network.

Cybercrime costs a total loss of about $338 billion annually which makes it one of the most profitable criminal activities in the world. Controlled malware (Botnet) is one of the most prominent tools used by cybercriminals to infect, compromise computer networks and steal important information. Infecting a computer is relatively easy nowadays with malware that propagates through social networking in addition to the traditional methods like SPAM messages and email attachments. In fact, more than 1/4 of all computers in the world are infected by malware which makes them viable for botnet use. This thesis proposes, implements and presents the Self-healing framework that takes inspiration from the human immune system. The designed self-healing framework utilises the key characteristics and attributes of the nature’s immune system to reverse botnet infections. It employs its main components to heal the infected nodes. If the healing process was not successful for any reason, it immediately removes the infected node from the Enterprise’s network to a quarantined network to avoid any further botnet propagation and alert the Administrators for human intervention. The designed self-healing framework was tested and validated using different experiments and the results show that it efficiently heals the infected workstations in an Enterprise network.

This work is a compilation of four manuscripts, three of which are published and one is in the second round of review, all in refereed journals. All four manuscripts focus on analysis of stochastic disruptions to support design of capacitated engineered networks. The work is motivated by limited ability to mitigate elevated risk exposure of large-scale capacitated enterprise networks functioning in lean environments. Such inability to sustain enterprise capacity in the face of disruptions of various origins has been causing multi-billion enterprise forfeitures and hefty insurance premiums. At the same time, decision support methodologies for reliable design of dynamic capacitated networks have been largely unavailable. This work is organized as follows. Paper 1 presents a methodology to analyze ca- pacitated healthcare supply chains using a framework of forward ow-matching networks with multiple points of delivery. Special emphasis is given to developing stochastic models for capturing capacity trajectories at the points of delivery. Paper 2 focuses on assuring capacity availability for a critical vertex exposed to random stepwise capacity disruptions with exponentially distributed interarrival times and uniformly distributed magnitudes. We explore two countermeasure policies for a risk-neutral decision maker who seeks to maxi- mize the long-run average reward. We present an extensive numerical analysis as well as a sensitivity study on the uctuations of some system parameter values. Paper 3 extends the capacity assurance analysis for critical vertices by considering stepwise partial system capacity loss accumulating over time. We examine implementation of a countermeasure policy, aimed at reducing the disruption rate, for a risk-neutral decision maker who seeks to maximize long-run average return. We explore how the policy of maintaining the optimal disruption rate is aected by a number of system parameters. Finally, Paper 4 presents a dynamic predictive methodology for mitigation of cross-regional pandemic outbreaks which can be used to estimate workforce capacity loss for critical vertices due to such societal disasters.

A presente tese aborda o tema sobre o processo de formação, desenvolvimento e consolidação de redes entre Pequenas e Médias Empresas (PMEs) e sua contribuição para o desenvolvimento regional. Partindo da revisão analítica das teorias de redes interorganizacionais, de criação, desenvolvimento, consolidação e dos processos de gestão, buscou-se a compreensão da relevância estratégica das redes para o desenvolvimento regional. A partir de evidências teóricas, a questão da pesquisa confrontada foi compreender como ocorrem formação e desenvolvimento de redes interempresariais horizontais e sua contribuição para o desenvolvimento regional. A pesquisa estudou e qualificou os fatores subjacentes à formação e consolidação de redes horizontais de cooperação e sua contribuição para o desenvolvimento regional. No estágio de formação da rede, são analisados os fatores de motivação, escolha do grupo, papel da liderança e a confiança. No processo de desenvolvimento/consolidação, a análise dá-se na direção de fatores de gestão - preparação das empresas, coordenação, governança e escolha dos parceiros - e dos fatores sociais - liderança, capital social e confiança. A contribuição das redes para o desenvolvimento regional foca fatores econômicos e sociais. Para verificar a experiência da construção e consolidação das redes, o delineamento da pesquisa é de um estudo exploratório, com procedimento técnico de casos. A pesquisa empírica foi conduzida por meio de entrevistas com os primeiros e atuais presidentes de nove redes horizontais na Região Central do Estado do Rio Grande do Sul (RS). Também, para melhor entender o fenômeno e aprofundar o estudo aplicou-se um questionário junto aos empresários fundadores das redes. Os resultados da pesquisa evidenciam que as pressões contingenciais, como a concorrência, a dificuldade de obter recursos, a falta de crédito, o baixo volume de negócio, exercem influência na motivação para formar redes, que buscam complementaridade de conhecimentos e resultados econômicos. O desenvolvimento, a consolidação e a permanência no mercado das redes dependem de seu projeto, de seu processo de formação, de sua governança, bem como na capacidade de motivar seus membros e atrair outros novos. Outros resultados mostram que os mecanismos de coordenação utilizados para facilitar a governança e a liderança exercem influência nos relacionamentos e na gestão. Verificou-se que a quantidade e a qualidade de interações existentes no contexto de uma rede exercem influência nos níveis de conectividade entre as empresas, na construção do capital social e da confiança e esses fatores levam ao desenvolvimento e consolidação das redes que impactam positivamente o desenvolvimento regional. Em síntese, esses resultados sinalizam a existência de redes consolidadas como resultado de pressões contingenciais, escolha dos parceiros, coordenação, governança, liderança, capital social, confiança e situações de interação social. O fortalecimento e o crescimento das redes impactam positivamente o desenvolvimento socioeconômico da sua região. / The thesis addresses the building and strengthening of networks among small and medium size enterprises (SMEs) and their effect on regional development. An analytical review of inter-organisational networks theories, focused on the foundation, development, consolidation and management processes as well as the strategic relevance of networks for regional development was initially examined. From theoretical evidence, this research also explored how the design, implementation and development of horizontal inter-company networks contribute to regional development. Underlying factors to the strengthening of teamwork among SMEs in horizontal networks and its relation with regional development were explored and categorized. In the network founding stage, factors as motivation, group choice, role of leadership and trust building are investigated. In the strengthening stage, management factors as enterprises readiness, coordination, governance and selection of partners were highlighted. Social factors as leadership, social capital and trust were also screened. With regard to networks contribution to regional development, economic and social factors were considered. Founding and strengthening of networks was also researched trough an exploratory study focused on real cases. Empirical research was conducted through interviews with former and current heads of nine horizontal networks in the central region of Rio Grande do Sul (RS), south of Brazil. In addition, to better understand the occurrences, a questionnaire was designed and applied to the business founders of such networks. Research outcomes reveal the difficulties faced by business, which induced networks formation. Among those difficulties are competition, limited access to resources, lack of credit and insufficient business scale, which induce networks formation to seek complementarity of knowledge and business results improvement. Complementarily, it was perceived that network longevity depend on their project, their formation process, its governance, and the ability to motivate its members and to attract new ones. Other research outcomes reveal the importance of coordination mechanisms to enable good governance as well as of leadership to smooth relationships and stimulate appropriate management. It was observed that the quantity and quality of effective interactions within a network determine the levels of connectivity among the enterprises that belong to a network. Those interactions establish also the social capital construct and trust; factors that strengthen networks with positive impact on regional development. In summary, research outcomes endorse the evidence that well-established horizontal networks originated from severe business constraints faced up by good partnering, adequate coordination, suitable governance, responsible leadership, social capital construct, trust building and effective social interactions. It was also observed that the strengthening and growth of networks impact positively the socio-economic development of a region.

A presente tese aborda o tema sobre o processo de formação, desenvolvimento e consolidação de redes entre Pequenas e Médias Empresas (PMEs) e sua contribuição para o desenvolvimento regional. Partindo da revisão analítica das teorias de redes interorganizacionais, de criação, desenvolvimento, consolidação e dos processos de gestão, buscou-se a compreensão da relevância estratégica das redes para o desenvolvimento regional. A partir de evidências teóricas, a questão da pesquisa confrontada foi compreender como ocorrem formação e desenvolvimento de redes interempresariais horizontais e sua contribuição para o desenvolvimento regional. A pesquisa estudou e qualificou os fatores subjacentes à formação e consolidação de redes horizontais de cooperação e sua contribuição para o desenvolvimento regional. No estágio de formação da rede, são analisados os fatores de motivação, escolha do grupo, papel da liderança e a confiança. No processo de desenvolvimento/consolidação, a análise dá-se na direção de fatores de gestão - preparação das empresas, coordenação, governança e escolha dos parceiros - e dos fatores sociais - liderança, capital social e confiança. A contribuição das redes para o desenvolvimento regional foca fatores econômicos e sociais. Para verificar a experiência da construção e consolidação das redes, o delineamento da pesquisa é de um estudo exploratório, com procedimento técnico de casos. A pesquisa empírica foi conduzida por meio de entrevistas com os primeiros e atuais presidentes de nove redes horizontais na Região Central do Estado do Rio Grande do Sul (RS). Também, para melhor entender o fenômeno e aprofundar o estudo aplicou-se um questionário junto aos empresários fundadores das redes. Os resultados da pesquisa evidenciam que as pressões contingenciais, como a concorrência, a dificuldade de obter recursos, a falta de crédito, o baixo volume de negócio, exercem influência na motivação para formar redes, que buscam complementaridade de conhecimentos e resultados econômicos. O desenvolvimento, a consolidação e a permanência no mercado das redes dependem de seu projeto, de seu processo de formação, de sua governança, bem como na capacidade de motivar seus membros e atrair outros novos. Outros resultados mostram que os mecanismos de coordenação utilizados para facilitar a governança e a liderança exercem influência nos relacionamentos e na gestão. Verificou-se que a quantidade e a qualidade de interações existentes no contexto de uma rede exercem influência nos níveis de conectividade entre as empresas, na construção do capital social e da confiança e esses fatores levam ao desenvolvimento e consolidação das redes que impactam positivamente o desenvolvimento regional. Em síntese, esses resultados sinalizam a existência de redes consolidadas como resultado de pressões contingenciais, escolha dos parceiros, coordenação, governança, liderança, capital social, confiança e situações de interação social. O fortalecimento e o crescimento das redes impactam positivamente o desenvolvimento socioeconômico da sua região. / The thesis addresses the building and strengthening of networks among small and medium size enterprises (SMEs) and their effect on regional development. An analytical review of inter-organisational networks theories, focused on the foundation, development, consolidation and management processes as well as the strategic relevance of networks for regional development was initially examined. From theoretical evidence, this research also explored how the design, implementation and development of horizontal inter-company networks contribute to regional development. Underlying factors to the strengthening of teamwork among SMEs in horizontal networks and its relation with regional development were explored and categorized. In the network founding stage, factors as motivation, group choice, role of leadership and trust building are investigated. In the strengthening stage, management factors as enterprises readiness, coordination, governance and selection of partners were highlighted. Social factors as leadership, social capital and trust were also screened. With regard to networks contribution to regional development, economic and social factors were considered. Founding and strengthening of networks was also researched trough an exploratory study focused on real cases. Empirical research was conducted through interviews with former and current heads of nine horizontal networks in the central region of Rio Grande do Sul (RS), south of Brazil. In addition, to better understand the occurrences, a questionnaire was designed and applied to the business founders of such networks. Research outcomes reveal the difficulties faced by business, which induced networks formation. Among those difficulties are competition, limited access to resources, lack of credit and insufficient business scale, which induce networks formation to seek complementarity of knowledge and business results improvement. Complementarily, it was perceived that network longevity depend on their project, their formation process, its governance, and the ability to motivate its members and to attract new ones. Other research outcomes reveal the importance of coordination mechanisms to enable good governance as well as of leadership to smooth relationships and stimulate appropriate management. It was observed that the quantity and quality of effective interactions within a network determine the levels of connectivity among the enterprises that belong to a network. Those interactions establish also the social capital construct and trust; factors that strengthen networks with positive impact on regional development. In summary, research outcomes endorse the evidence that well-established horizontal networks originated from severe business constraints faced up by good partnering, adequate coordination, suitable governance, responsible leadership, social capital construct, trust building and effective social interactions. It was also observed that the strengthening and growth of networks impact positively the socio-economic development of a region.

Hoje em dia, distribuições de grandes volumes de dados por redes TCP/IP corporativas trazem problemas como a alta utilização da rede e de servidores, longos períodos para conclusão e maior sensibilidade a falhas na infraestrutura de rede. Estes problemas podem ser reduzidos com utilização de redes par-a-par (P2P). O objetivo desta dissertação é analisar o desempenho do protocolo BitTorrent padrão em redes corporativas e também realizar a análise após uma modificação no comportamento padrão do protocolo BitTorrent. Nesta modificação, o rastreador identifica o endereço IP do par que está solicitando a lista de endereços IP do enxame e envia somente aqueles pertencentes à mesma rede local e ao semeador original, com o objetivo de reduzir o tráfego em redes de longa distância. Em cenários corporativos típicos, as simulações mostraram que a alteração é capaz de reduzir o consumo médio de banda e o tempo médio dos downloads, quando comparados ao BitTorrent padrão, além de conferir maior robustez à distribuição em casos de falhas em enlaces de longa distância. As simulações mostraram também que em ambientes mais complexos, com muitos clientes, e onde a restrição de banda em enlaces de longa distância provoca congestionamento e descartes, o desempenho do protocolo BitTorrent padrão pode ser semelhante a uma distribuição em arquitetura cliente-servidor. Neste último caso, a modificação proposta mostrou resultados consistentes de melhoria do desempenho da distribuição. / Nowadays, distributions of large volumes of data over enterprise TCP/IP networks bring problems such as high network and server utilizations, long periods for completion, and greater sensitivity to flaws in network infrastructure. These problems can be reduced with the use of Peer-to-Peer networks (P2P). The aim of this work is to analyze the performance of the standard BitTorrent protocol in corporate networks and also perform the analysis after a change in the default behavior of the BitTorrent protocol. In this modification, the tracker identifies the peer IP address requesting the list of IP addresses of the swarm and sends only those belonging to the same LAN and to the original seeder, with the aim of reducing traffic on WAN links. In typical enterprise scenarios, the simulations showed that the change is able to reduce the average bandwidth consumption and the average time of downloads compared with standard BitTorrent, and give greater robustness to the distribution in case of failure of WAN links. The simulations also showed that in more complex network environments, with many clients, and where the bandwidth restriction on long distance links causes congestion and packet drops, the performance of standard BitTorrent protocol can be similar than a distribution in client-server architecture. In the latter case, the proposed change showed consistent results in improving distribution performance.

Hoje em dia, distribuições de grandes volumes de dados por redes TCP/IP corporativas trazem problemas como a alta utilização da rede e de servidores, longos períodos para conclusão e maior sensibilidade a falhas na infraestrutura de rede. Estes problemas podem ser reduzidos com utilização de redes par-a-par (P2P). O objetivo desta dissertação é analisar o desempenho do protocolo BitTorrent padrão em redes corporativas e também realizar a análise após uma modificação no comportamento padrão do protocolo BitTorrent. Nesta modificação, o rastreador identifica o endereço IP do par que está solicitando a lista de endereços IP do enxame e envia somente aqueles pertencentes à mesma rede local e ao semeador original, com o objetivo de reduzir o tráfego em redes de longa distância. Em cenários corporativos típicos, as simulações mostraram que a alteração é capaz de reduzir o consumo médio de banda e o tempo médio dos downloads, quando comparados ao BitTorrent padrão, além de conferir maior robustez à distribuição em casos de falhas em enlaces de longa distância. As simulações mostraram também que em ambientes mais complexos, com muitos clientes, e onde a restrição de banda em enlaces de longa distância provoca congestionamento e descartes, o desempenho do protocolo BitTorrent padrão pode ser semelhante a uma distribuição em arquitetura cliente-servidor. Neste último caso, a modificação proposta mostrou resultados consistentes de melhoria do desempenho da distribuição. / Nowadays, distributions of large volumes of data over enterprise TCP/IP networks bring problems such as high network and server utilizations, long periods for completion, and greater sensitivity to flaws in network infrastructure. These problems can be reduced with the use of Peer-to-Peer networks (P2P). The aim of this work is to analyze the performance of the standard BitTorrent protocol in corporate networks and also perform the analysis after a change in the default behavior of the BitTorrent protocol. In this modification, the tracker identifies the peer IP address requesting the list of IP addresses of the swarm and sends only those belonging to the same LAN and to the original seeder, with the aim of reducing traffic on WAN links. In typical enterprise scenarios, the simulations showed that the change is able to reduce the average bandwidth consumption and the average time of downloads compared with standard BitTorrent, and give greater robustness to the distribution in case of failure of WAN links. The simulations also showed that in more complex network environments, with many clients, and where the bandwidth restriction on long distance links causes congestion and packet drops, the performance of standard BitTorrent protocol can be similar than a distribution in client-server architecture. In the latter case, the proposed change showed consistent results in improving distribution performance.

We consider the problem of designing enterprise network security systems which are easy to manage, robust and flexible. This problem is challenging. Today, most approaches rely on host security, middleboxes, and complex interactions between many protocols. To solve this problem, we explore how new programmable networking paradigms can facilitate fine-grained network control. We present Resonance, a system for securing enterprise networks , where the network elements themselves en- force dynamic access control policies through state changes based on both flow-level information and real-time alerts. Resonance uses programmable switches to manipulate traffic at lower layers; these switches take actions (e.g., dropping or redirecting traffic) to enforce high-level security policies based on input from both higher-level security boxes and distributed monitoring and inference systems. Using our approach, administrators can create security applications by first identifying a state machine to represent different policy changes and then, translating these states into actual network policies. Earlier approaches in this direction (e.g., Ethane, Sane) have remained low-level requiring policies to be written in languages which are too detailed and are difficult for regular users and administrators to comprehend. As a result, significant effort is needed to package policies, events and network devices into a high-level application. Resonance abstracts out all the details through its state-machine based policy specification framework and presents security functions which are close to the end system and hence, more tractable. To demonstrate how well Resonance can be applied to existing systems, we consider two use cases. First relates to "Network Admission Control" problem. Georgia Tech dormitories currently use a system called START (Scanning Technology for Automated Registration, Repair, and Response Tasks) to authenticate and secure new hosts entering the network [23]. START uses a VLAN-based approach to isolate new hosts from authenticated hosts, along with a series of network device interactions. VLANs are notoriously difficult to use, requiring much hand-holding and manual configuration. Our interactions with the dorm network administrators have revealed that this existing system is not only difficult to manage and scale but also inflexible, allowing only coarse-grained access control. We implemented START by expressing its functions in the Resonance framework. The current system is deployed across three buildings in Georgia Tech with both wired as well as wireless connectivities. We present an evaluation of our system's scalability and performance. We consider dynamic rate limiting as the second use case for Resonance. We show how a network policy that relies on rate limiting and traffic shaping can easily be implemented using only a few state transitions. We plan to expand our deployment to more users and buildings and support more complex policies as an extension to our ongoing work. Main contributions of this thesis include design and implementation of a flexible access control model, evaluation studies of our system's scalability and performance, and a campus-wide testbed setup with a working version of Resonance running. Our preliminary evaluations suggest that Resonance is scalable and can be potentially deployed in production networks. Our work can provide a good platform for more advanced and powerful security techniques for enterprise networks.

In this thesis, we propose a decentralized peer-to-peer (P2P) Web proxy cache for enterprise networks (ENs). Currently, enterprises use a centralized proxy-based Web cache, where a dedicated proxy server does the caching. A dedicated proxy Web Cache has to be over-provisioned to handle peak loads. It is expensive, a single point of failure, and a bottleneck. In a P2P Web Cache, the clients themselves cooperate in caching the Web objects without any dedicated proxy cache. The resources from the client machines are pooled together to form a Web cache. This eliminates the need for extra hardware and the single point of failure, and improves the average response time, since all the machines serve the request queue. The most important attraction for the P2P scheme is its inherent scalability. Squirrel was the earliest P2P Web cache. Squirrel is built upon a structured P2P protocol called Pastry. Pastry is based on consistent hashing; a special hashing that performs well in the presence of client membership changes. Consistent hashing based protocols are designed for Internet-wide environments to handle very large membership sizes and high rates of membership change. To minimize the protocol bandwidth, the membership state maintained at each peer is very small. This state consists of the information about the peer’s immediate neighbours, and those of a few other P2P members, to achieve faster look-up. This scheme has the following advantages: (i) since peers do not maintain information about all the other peers in the system, any peer needing an object has to find the peer responsible for the object through a multi-hop lookup, thereby increasing the latency, and (ii) the number of objIds assigned to a peer depends on the hashing used, and this can be skewed, which affects the load distribution. The popular applications of the P2P paradigm have been file-sharing systems. These systems are deployed across the Internet. Hence, the existing P2P protocols were designed to operate within the constraints of Internet environments. The P2P proxy Web cache has been a recent application of the P2P paradigm. P2P Web Proxy caches operate across the entire network of an enterprise. An enterprise network(EN) comprises all the computing and communications capabilities of an institution. Institutions typically consist of many departments, with each department having and managing its own local area netwok (LAN). The available bandwidth in LANs is very high. LANs have low latency and low error rates. EN environments have smaller membership size, less frequent membership changes and more available bandwidth. Hence, in such environments, the P2P protocol can afford to store more membership information. This thesis explores the significant differences between EN and Internet environments. It proposes a new P2P protocol designed to exploit these differences, and a P2P Web proxy caching scheme based on this new protocol. Specifically, it shows that it is possible to maintain complete the consistent membership information on ENs. The thesis then presents a load distribution policy for a P2P system with complete and consistent membership information to achieve (i) load balance and (ii) minimum object migrations subsequent to each node join or node leave event. The proposed system requires extra storage and bandwidth costs. We have seen that the necessary storage is available in general workstations and the required bandwidth is feasible in modern networks. We then evaluated the improvement in performance achieved by the system over existing consistent hashing based systems. We have shown that without investing in any special hardware, the P2P system can match the performance of dedicated proxy caches. We have further shown that the buddy based P2P scheme has a better load distribution, especially under heavy loads when load balancing becomes critical. We have also shown that for large P2P systems, the buddy based scheme has a lower latency than the consistent hashing based schemes. Further, we have compared the costs of the proposed scheme and the existing consistent hashing based scheme for different loads (i.e., rate of Web object requests), and identified the situations in which the proposed scheme is likely to perform best. In summary, the thesis shows that (i) the membership dynamics of P2P systems on ENs are different from that of Internet file-sharing systems and (ii) it is feasible in ENs, to maintain complete the consistent view of the P2P membership at all the peers. We have designed a structured P2P protocol for LANs that maintains a complete and consistent view of membership information at all peers. P2P Web caches achieve single hop routing and a better balanced load distribution using this scheme. Complete and consistent view of membership information enabled a single-hop lookup and a flexible load assignment.

No description available.